Amazon Q Developer, formerly CodeWhisperer, is safe to use and includes a built-in security scan, but its inline suggestions are still generated to produce working code first. It can suggest a hardcoded credential, a permissive IAM or resource policy, or an endpoint that does not check the caller. Treat its suggestions as a draft to review, and lean on its scanner plus your own checks rather than trusting the completion as secure.
The risks that actually matter
Hardcoded credentials in suggestions
An accepted completion can include a literal key or connection string that then ships to the repo.
Overly permissive cloud policies
When wiring up AWS resources, suggested IAM or bucket policies can grant far broader access than the task needs, which is easy to accept without noticing.
Endpoints without authorization
Generated handlers may return or change data without verifying the caller, leaving the route open to anyone.
How to secure a Amazon Q Developer app
- Run Amazon Q's built-in security scan and treat findings as required fixes, not suggestions.
- Reject completions that inline a secret; use environment variables or a secrets manager.
- Scope IAM and resource policies to least privilege; do not accept wildcard grants.
- Add server-side auth to generated endpoints and scan before you deploy.